DRF permissions in Django - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What is the output of this permission check?

Given this Django REST Framework view permission setup, what will be the response status code if an unauthenticated user tries to access the view?

Django

from rest_framework.permissions import IsAuthenticated
from rest_framework.views import APIView
from rest_framework.response import Response

class MyView(APIView):
    permission_classes = [IsAuthenticated]

    def get(self, request):
        return Response({'message': 'Hello, authenticated user!'})

A 401 Unauthorized error

B 403 Forbidden error

C 500 Internal Server Error

D 200 OK with message 'Hello, authenticated user!'

💡 Hint

Think about what happens when a user is not logged in and the view requires authentication.

The IsAuthenticated permission class denies access to unauthenticated users by returning a 401 Unauthorized response. It does not return 403 Forbidden, which is for authenticated users without permission.

📝 Syntax

intermediate

Which option correctly applies multiple permissions in DRF?

You want to require that a user is authenticated and also has admin rights. Which of these permission_classes declarations is syntactically correct and will enforce both permissions?

A permission_classes = {IsAuthenticated, IsAdminUser}

B permission_classes = IsAuthenticated & IsAdminUser

C permission_classes = (IsAuthenticated, IsAdminUser)

D permission_classes = [IsAuthenticated, IsAdminUser]

💡 Hint

Remember that permission_classes expects a list or tuple of permission classes.

The permission_classes attribute must be a list or tuple of permission classes. Option D uses a list, which is correct. Option D uses bitwise AND which is invalid here. Option D is a tuple, so it is valid syntax but less common; however, DRF accepts tuples too. Option D uses a set which is not supported.

However, since option D is a tuple, it is syntactically valid but less common. To avoid ambiguity, the question expects the list form as the correct answer.

🔧 Debug

advanced

Why does this custom permission always deny access?

Examine this custom permission class. Why does it always deny access even for authenticated users?

Django

from rest_framework.permissions import BasePermission

class IsOwner(BasePermission):
    def has_object_permission(self, request, view, obj):
        if request.user == obj.owner:
            return True
        return False

A Because the class is missing an __init__ method

B Because request.user is never equal to obj.owner

C Because the method lacks a return False for the else case, so it returns None which is treated as False

D Because BasePermission requires has_permission method to be defined

💡 Hint

Think about what happens if the if condition is false and no return statement is given.

If the has_object_permission method does not explicitly return False when the condition fails, it returns None by default. DRF treats None as False, so permission is denied.

❓ state_output

advanced

What is the value of `permission_granted` after this check?

Given this code snippet, what will be the value of the variable permission_granted after calling the permission check?

Django

from rest_framework.permissions import IsAuthenticated

class DummyRequest:
    def __init__(self, user):
        self.user = user

class DummyUser:
    def __init__(self, is_authenticated):
        self.is_authenticated = is_authenticated

request = DummyRequest(DummyUser(is_authenticated=False))
permission = IsAuthenticated()
permission_granted = permission.has_permission(request, None)

A False

B True

C Raises AttributeError

D None

💡 Hint

Check how IsAuthenticated checks the user property.

The IsAuthenticated permission checks if request.user.is_authenticated is True. Here, it is False, so has_permission returns False.

🧠 Conceptual

expert

Which permission class combination enforces read-only for all but write access only for owners?

You want a view where anyone can read data, but only the owner of an object can update or delete it. Which combination of permission classes and methods achieves this behavior correctly?

A Use IsAdminUser for all requests and override has_permission to check ownership

B Use IsAuthenticatedOrReadOnly and a custom IsOwner permission in has_object_permission to allow writes only for owners

C Use AllowAny and check ownership in the serializer's save method

D Use IsAuthenticated and override get_queryset to filter only owner objects

💡 Hint

Think about how to allow everyone to read but restrict writes to owners.

IsAuthenticatedOrReadOnly allows anyone to read but requires authentication for write actions. Combining it with a custom IsOwner permission in has_object_permission ensures only owners can write. Other options either restrict too much or do not enforce permissions properly.